Privacy policy

Your progress. Your choices. Pocket Port stores gameplay on your device. Optional Google sign-in lets you back it up to our cloud service. Google Play handles purchases. You can request deletion without reinstalling the game.

Effective 28 September 2026. This policy covers Pocket Port's Android game and its account, purchase-verification and cloud-save services, including internal testing. The controller is NOT NORMAL SERVICOS DIGITAIS LTDA, Brazil. Contact hello@agencianotnormal.com for privacy questions or requests. You may write in Portuguese, English or Spanish.

Information we use

• Gameplay: level progress, the current board, coins, boosters, settings, reward history and purchased entitlements are saved locally. If you connect Google cloud saves, your gameplay profile and saved board are uploaded to Firebase/Google Cloud and associated with your game account.
• Account: the purchasing service creates an anonymous Firebase account when it starts. Optional Google sign-in links a Google account to your game account; Firebase stores the linked account email and may receive other basic Google profile information supplied during sign-in. We do not use a Google profile name in the game. We use the account identifier to find your backup and verify ownership. We do not receive your Google password.
• Purchases: Google Play processes payment. Our service receives product identifiers, purchase tokens and status information to verify orders and deliver coins, boosters and entitlements. It records the account association, grant identifier and transaction history to avoid duplicate fulfillment. Our game server does not receive your full card number. The Unity IAP purchasing SDK also sends purchase and restore events, such as product, transaction and device information, to Unity for purchase reporting and service analytics. Unity IAP's published SDK disclosure also lists approximate location, identifiers, diagnostics, crash logs and other performance data for service operation and analytics; this processing is separate from your advertising choice.
• Security and technical data: Firebase App Check and Google Play Integrity process app/device attestation. Google/Firebase hosting services process network information, including IP addresses, request metadata and operational logs. These help operate and protect the service.
• Support: if you contact us, we receive your email address and the information you send. Please do not send passwords, authentication tokens or payment-card details.

Why we use information

We use this information to run the game, save and restore progress, deliver and verify purchases, prevent abuse, answer support requests and meet applicable obligations. Where applicable, our legal bases include performing the service you request, legitimate interests in security and fraud prevention, legal obligations, and consent for optional advertising. Where consent is required for a specific use, we request it before that use.

Advertising choices

Android internal test build 24 enables Unity Ads in test mode. Earlier test builds may keep ads disabled. Test mode uses test ad content; it does not mean that the advertising SDK processes no data. Paid advertising is not enabled in this test build. Before ads are enabled, the app requires an adult age-band selection and an affirmative advertising choice. In the current privacy controls, ads remain off for ages 13–17, unknown ages and declined or withdrawn choices. Only an age band is recorded locally; we do not ask for a birth date.

When enabled and you opt in, Unity Ads may process device/advertising identifiers, IP-derived location, device and network information, ad interactions and diagnostics to deliver, personalize and measure advertising and prevent fraud. You can revisit Settings → Ad Privacy and turn ads off. Declining advertising does not prevent core gameplay. We do not sell your cloud-save profile or purchase tokens. Advertising-provider processing can be considered sharing or targeted advertising under some laws; our advertising controls keep it off unless you opt in as an adult. Unity handles its own ad data separately from our game account. To request access to or deletion of Unity-held advertising data, use the Data Privacy control shown in a Unity ad or the options in Unity's game-player privacy policy. Deleting a Pocket Port account does not itself delete Unity's records.

Providers and international processing

We use Google Play, Firebase Authentication, Firestore, Cloud Functions, App Check and Play Integrity for purchases, accounts, backups and security. Unity IAP processes purchasing events and related technical information even when advertising is off. Unity Ads is used for opted-in test advertising as described above. Our cloud-save endpoint runs in the United States. Providers may process data in other countries. We use the providers' contractual data-protection arrangements where applicable. The public website is hosted by Vercel, which processes normal web-request information. Our email provider processes support messages.

See Firebase privacy information, Google's privacy policy and Vercel's privacy policy. We may also disclose information where necessary to comply with law or protect the service and users.

Storage, retention and deletion

Local saves remain on your device until removed; operating-system backups may have separate behavior. Cloud saves and account records remain available while the account is retained, unless you request deletion. Uninstalling does not delete server records. A Google backup must complete successfully before you rely on restoration after uninstalling.

Our deletion policy is to verify account ownership, reconcile any outstanding purchases, then remove the Pocket Port game account, cloud progress, raw purchase tokens and personal account identifiers from our grant records. A purchase dispute or unsettled grant can delay that final step; we explain the reason and next action. We retain only minimal coded revoked-grant records and a security lock while needed to prevent duplicate credits or reuse of a purchase. A hash or coded key can still be personal data; we do not treat it as anonymous or keep it merely because it is hashed. We retain the completion receipt for 30 days after completion, then remove it through reviewed cleanup. We explain any applicable legal exception or longer provider-held retention in our response. Unity IAP retains its own purchase and technical records under its service rules; Unity says it handles IAP access and deletion requests manually. For IAP data Unity processes for us, contact Pocket Port so we can verify your request and instruct Unity. For any IAP records Unity controls independently, contact unity-iap-contact@unity3d.com directly. Google Play payment records, provider security logs and backups follow their own policies and obligations. Request email starts review, not automatic deletion, and we confirm completion only after the actual records have been checked.

Support messages are kept while needed to resolve the request and related disputes or obligations. Retention is reviewed according to the purpose and applicable law. Data is not automatically deleted merely because a player becomes inactive.

Your rights and requests

Depending on your location, you may request access, correction, deletion, portability, restriction or objection to processing, or withdraw consent. You may also complain to your local data-protection authority, including Brazil's ANPD or the relevant European supervisory authority. We may need proportionate verification before releasing or deleting account data. We respond within applicable legal deadlines and explain any permitted extension or retention exception.

Request account or data deletion

Account deletion does not automatically request a purchase refund. Contact us for purchase support; Google Play may also offer refund options under its policies. A local copy of your game may remain on the device until you clear it.

Security

Our account, backup and purchase endpoints use HTTPS. The cloud-save service requires Firebase authentication, a linked Google identity and app attestation; direct client database access is restricted. We limit access to authorized service operators. No system is completely secure.

Age audience

Pocket Port is intended for teens aged 13–17 and adults, not children under 13. If you believe a child under 13 provided personal information, contact us so we can investigate and handle it appropriately.

Policy updates

We update the date when this policy changes. Material changes to data use or choices will be explained in the app or through another appropriate notice when required.